Privacy Notice

Maintained by

Lead Ignition Ltd

Version

2.1 (replaces version 2.0 of 7 October 2026)

Next review

12 months after approval, or on material change

Applies to

leadignition.co.uk, our client portal and apps, and our own business records

Classification

Public

Approval

Signed by Alex Moyies, Director, 10 October 2026

Last updated: 10 October 2026

1. Who we are

Lead Ignition Ltd (Lead Ignition, we, us) is a CRM and automation agency. We are a company registered in England and Wales with company number 15542026. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

We are registered with the Information Commissioner's Office (ICO) under registration number ZB780862.

This notice explains how we use personal information when we act as a controller: that is, when we decide why and how it is used. That covers visitors to our website, people who enquire about our services, our clients' staff who work with us, our suppliers and contractors, and people who apply to work with us.

You can contact us about this notice or your information at:

• Email: [email protected] for anything about your personal data, or [email protected] for everything else
• Phone: 020 7177 1702
• Post: Lead Ignition Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ

Our data protection lead is Alex Moyies, Director, who you can reach at [email protected]. We are not required to appoint a statutory Data Protection Officer.

2. When we process data for our clients

Most of the personal information in the systems we build and run belongs to our clients. When a business uses the Lead Ignition CRM or an app we have built for it, that business is the controller of the information about its own customers, enquirers and staff, and we are its processor. We act only on our client's instructions under a written data processing agreement, and we never use that information for our own purposes, including marketing.

Some of our clients' systems hold more sensitive information, such as health information needed for insurance advice, or information about children for a charity. We handle it only as a processor, only in the systems the client has approved in writing, and with the additional safeguards set out in our data processing agreement.

If you are a customer of one of our clients and want to know how your information is used, or want to exercise your rights, please contact that business directly. Its own privacy notice applies. If you contact us instead, we will pass your request to the business concerned within 2 business days.

The rest of this notice covers only the information we control ourselves.

3. What we collect and where it comes from

You do not have to give us your personal information. If you don't, we may not be able to reply to you, and some information is needed to enter into or carry out a contract with us (such as billing details) or to meet a legal requirement (such as right to work checks).

For our own purposes, we do not knowingly collect information about children, and our own services are not aimed at them. Some of our clients hold information about children in the systems we run for them: see section 2.

4. Why we use it and our lawful basis

Where we rely on legitimate interests, we have carried out a legitimate interests assessment balancing our interests against yours. You can ask us for a copy.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Marketing

We may send business contacts information about our services by email or phone where it is relevant to their role. You can opt out at any time using the unsubscribe link in any email or by contacting us, and we will keep a record so that we do not contact you again.

Where the law requires consent (for example, emails to sole traders and some partnerships), we will only send marketing emails if you have agreed, or if you are an existing client and we are telling you about similar services and you have not opted out. We never sell personal information.

6. Who we share it with

We share personal information only where needed, with:

• our service providers, who process it for us under written contracts. These are listed on our Trust page at leadignition.co.uk/trust. They include Google (email and documents), our CRM platform provider (our own CRM records), Otter.ai (meeting transcription), Stripe (payments), Vercel (website hosting and analytics), Supabase (app databases), Cloudflare (website security), Anthropic (the AI provider that powers Sparky and our AI tools) and Virtual Admin Assistance (VAA UK), which helps manage our inbox and calendar;
• advertising platforms (Google, Meta and TikTok), only where you have consented to their cookies. For collecting and sending this information, we and the platform are joint controllers; the platform is responsible for what it does with the information afterwards, under its own privacy policy;
• our professional advisers, such as our accountants, lawyers and insurers;
• the ICO, HM Revenue and Customs, law enforcement or a court, where the law requires it; and
• a buyer or successor if our business is sold or reorganised, under confidentiality.

7. International transfers

Some of our service providers are based in, or access data from, the United States and other countries outside the UK. Where we transfer personal information outside the UK, we make sure it is protected by one of these safeguards:

• UK adequacy regulations, including the UK-US data bridge where the recipient is certified;
• the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses; or
• another safeguard allowed by UK data protection law.

You can contact us for more information about the safeguards used.

8. How long we keep it

We keep personal information only for as long as we need it, in line with our Data Retention and Deletion Schedule. If a complaint, claim or regulator enquiry is open, we keep the related information until it is resolved. In summary:

"Kept for at least" is a legal minimum. "Deleted or anonymised by" is the latest we keep it: we review our records once a year and delete or anonymise anything past its date. Any contact with us, such as an email, call or meeting, restarts the clock.

9. How we protect it

We use multi-factor authentication, named accounts, encryption in transit and at rest, and access only where it is needed. Our providers are chosen with data protection in mind and bound by written terms.

If a personal data breach happens, we will report it to the ICO within 72 hours of becoming aware of it where the law requires, and we will tell you without undue delay if it is likely to put your rights and freedoms at high risk.

10. Your rights

You have the right to:

• ask for a copy of your personal information;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information in some circumstances;
• ask us to restrict how we use your information in some circumstances;
• object to our use of your information where we rely on legitimate interests, and to object at any time to direct marketing;
• ask us to transfer information you gave us to another organisation, in some circumstances; and
• withdraw your consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

To use any of these rights, email [email protected] or use the other contact details in section 1. We will respond within one month, and will not usually charge a fee. We may need to confirm your identity first. For complex requests we can extend this by up to two further months, and we will tell you if we do. The time does not run while we wait for information we need to confirm your identity or understand your request.

11. Complaints

If you are unhappy with how we have used your information, please complain to us first so we can try to put it right. You can do this by email to [email protected], by phone or by post, using the details in section 1. We aim to acknowledge your complaint within 1 business day, and always within 30 days. We will look into it, keep you updated and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113

12. Cookies

Our website uses cookie-free analytics. Advertising cookies are used only if you accept them. Our Cookie Policy explains this in full and how to change your choice: https://leadignition.co.uk/trust/documents/cookie-policy.

13. Changes to this notice

We review this notice at least once a year. If we make significant changes, we will update the date at the top and, where appropriate, tell our clients directly.